GHSA-54mg-vgrp-mwx9LowCVSS 3.7

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack

Published
May 14, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-11808 →

📋 Description

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.

🎯 Affected products3

  • maven/io.ratpack:ratpack-session:< 1.6.1
  • maven/io.ratpack:ratpack-java:< 1.6.1
  • maven/io.ratpack:ratpack-groovy:< 1.6.1

🔗 References (5)